CVE-2019-19642 describes an OS Command Injection vulnerability in SuperMicro X8STi-F motherboards running IPMI firmware 2.06 and BIOS 02.68. Authenticated attackers can exploit this by sending crafted HTTP POST requests to the Virtual Media feature, specifically to /rpc/setvmdrive.asp, using shell metacharacters in the ShareHost or ShareName parameters. This allows for arbitrary command execution and can lead to a persistent backdoor, earning a CVSS score of 8.8 (High) due to its network-based, low-privilege attack vector and high impact on confidentiality, integrity, and availability. While the EPSS score indicates a higher than average exploitability probability, there is currently no public exploit code (Metasploit, Nuclei, ExploitDB) and no evidence of active exploitation or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
02.68CPE matchmatch criteria | cpe:2.3:o:supermicro:x8sti-f_bios:02.68:*:*:*:*:*:*:* | ||
2.06CPE matchmatch criteria | cpe:2.3:o:supermicro:x8sti-f_firmware:2.06:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.